Static task
static1
Behavioral task
behavioral1
Sample
bff95ab29e8fc5c8aeeee9998d90c54e_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
bff95ab29e8fc5c8aeeee9998d90c54e_JaffaCakes118
-
Size
166KB
-
MD5
bff95ab29e8fc5c8aeeee9998d90c54e
-
SHA1
81db596d2d9cabce68f9772ba3cdbaa507794147
-
SHA256
9d32734173108a19e7ebea1749166cb3a7eda99ca7374359b148aa9f94f08e4e
-
SHA512
f0f9b7014d7092bd38a99c3358e81308ed6d344d1a5ee0214c2e4ae805c5184e44cee3ab1c12c4575a7965781d9a307d9bddf4807036fba52bda918cc3bd8184
-
SSDEEP
3072:IGeMBBe9UTieWv+o6ypkLNyl8FsLuXkUSM2QLZRfPk3MmpAWcsBVY3D:IAT+/vxfapuUSwVREVnViD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bff95ab29e8fc5c8aeeee9998d90c54e_JaffaCakes118
Files
-
bff95ab29e8fc5c8aeeee9998d90c54e_JaffaCakes118.dll windows:4 windows x86 arch:x86
833ff0de9197f49732d946c092af1fff
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedExchangeAdd
GetModuleFileNameA
GetProcAddress
GetStartupInfoA
GetUserDefaultLCID
MulDiv
VirtualAlloc
VirtualProtect
IsBadWritePtr
InterlockedExchange
LoadLibraryA
GetACP
Sleep
QueryPerformanceFrequency
IsDebuggerPresent
SetLastError
IsBadCodePtr
IsBadStringPtrA
GetCurrentProcess
GetProcessHeap
GetLastError
user32
GetWindowContextHelpId
GetClientRect
GetWindowTextLengthA
GetWindowTextA
IsCharAlphaNumericA
GetWindowDC
GetDC
WindowFromDC
GetForegroundWindow
CopyIcon
GetDlgItem
GetWindow
GetLastActivePopup
GetWindowInfo
GetWindowThreadProcessId
GetTopWindow
IsWindowVisible
GetGUIThreadInfo
IsChild
IsMenu
SetLastErrorEx
BlockInput
InSendMessage
GetWindowRect
advapi32
InitializeSecurityDescriptor
IsValidAcl
AreAnyAccessesGranted
GetUserNameA
RevertToSelf
msvcrt
_initterm
free
memmove
_swab
_CIsinh
_CIpow
rand
ldiv
div
_pctype
__doserrno
__mb_cur_max
malloc
_isctype
_adjust_fdiv
time
modf
_hypot
localeconv
floor
gdi32
GetPixel
GetStretchBltMode
GdiGetBatchLimit
GetROP2
GetBkMode
GetBitmapDimensionEx
ole32
CoDosDateTimeToFileTime
CoRevertToSelf
shell32
ord524
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ